Constant, unexplained "Could not check origin for Phoenix.Socket transport" errors in log

[kris-sigur]

I've set up plausible to run with the reverse proxy being hosted on a second machine that accepts connections from outside of our firewall using the Apache reverse proxy settings suggestions.

This works fine except I get a constant stream of errors like these:

[plausible]           | 08:56:59.081 [error] Could not check origin for Phoenix.Socket transport.
[plausible]           |
[plausible]           | Origin of the request: http://devserver.ourdomain.com:8000
[plausible]           |
[plausible]           | This happens when you are attempting a socket connection to
[plausible]           | a different host than the one configured in your config/
[plausible]           | files. For example, in development the host is configured
[plausible]           | to "localhost" but you may be trying to access it from
[plausible]           | "127.0.0.1". To fix this issue, you may either:
[plausible]           |
[plausible]           |   1. update [url: [host: ...]] to your actual host in the
[plausible]           |      config file for your current environment (recommended)
[plausible]           |
[plausible]           |   2. pass the :check_origin option when configuring your
[plausible]           |      endpoint or when configuring the transport in your
[plausible]           |      UserSocket module, explicitly outlining which origins
[plausible]           |      are allowed:
[plausible]           |
[plausible]           |         check_origin: ["https://example.com",
[plausible]           |                        "//another.com:888", "//other.com"]
[plausible]           | 
[plausible]           | 08:57:59.139 [error] Could not check origin for Phoenix.Socket transport.
...

These errors come consistently at 1 minute intervals even if - as far as I can tell - nothing is accessing the plausible instance. Accessing http://devserver.ourdomain.com:8000 directly in a web browser also does not seem to trigger this warning.

As I stated above, everything seems to be working as intended, I can register and start tracking. But this is making the log very noisy, so any advice on how to resolve this would be most welcome.

Configuration used:

plausible-conf.env:

BASE_URL=https://subdomain.ourdomain.com
SECRET_KEY_BASE=REDACTED
TOTP_VAULT_KEY=REDACTED
DATABASE_URL=postgres://postgres:REDACTED@plausible_db:5432/plausible_db

docker-compose.yml:

services:
  plausible_db:
    # Plausible v2.1.1 was tested against PostgreSQL versions 15 and 16
    # https://github.com/plausible/analytics/blob/v2.1.1/.github/workflows/elixir.yml#L21-L32
    image: postgres:16-alpine
    restart: always
    ports:
      - 5432:5432
    volumes:
      - db-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=REDACTED

  plausible_events_db:
    image: clickhouse/clickhouse-server:24.3.3.102-alpine
    restart: always
    volumes:
      - event-data:/var/lib/clickhouse
      - event-logs:/var/log/clickhouse-server
      - ./clickhouse/clickhouse-config.xml:/etc/clickhouse-server/config.d/logging.xml:ro
      - ./clickhouse/clickhouse-user-config.xml:/etc/clickhouse-server/users.d/logging.xml:ro
    ulimits:
      nofile:
        soft: 262144
        hard: 262144

  plausible:
    image: ghcr.io/plausible/community-edition:v2.1.1
    restart: always
    command: sh -c "sleep 10 && /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
    depends_on:
      - plausible_db
      - plausible_events_db
    ports:
      - 8000:8000
    env_file:
      - plausible-conf.env

volumes:
  db-data:
    driver: local
  event-data:
    driver: local
  event-logs:
    driver: local

[ruslandoga]

👋 @kris-sigur

Please share your configuration with real domain names. In short, the error means that Plausible receives WebSocket connection requests from an origin that is different from what you have set in BASE_URL. It's meant to protect from Cross-Site WebSocket Hijacking (CSWSH) attacks.

These errors come consistently at 1 minute intervals even if - as far as I can tell - nothing is accessing the plausible instance.

Something is :)